Startup-Credits Registry Verification, Agent-Readiness Telemetry & Docs-Tooling Schema Auditing in Production

Alex Le — Sun, 18 Oct 2026 02:57:21 +0000

Scraped credit pages go stale silently. We anchor each audit to a dated snapshot: sourcey.com and zenodo.org/10991201, both verified on 2026-10-18.

Snapshot: release sha256:1d5bd59cd7656b32…, audited 2026-10-18.

Downstream agents route workloads on these records, so one stale tier can misprice a whole batch. The validator below is deliberately small: every rule is a single line, and every failure returns a reason that can be logged and replayed.

Three ways feeds drift

Eligibility changes: the cohort rules or credit window shift while the landing URL stays the same.
Soft 404s: llms.txt or docs routes return 200 with an empty app shell.
Unit mix-ups: usd_cents integers mixed with "$5,000" strings misread tier limits by 100x.

Fail-closed record validator

Each record must pass host, date and age checks before it is indexed.

const HOSTS = new Set(["sourcey.com", "zenodo.org"]);
const DATE = /^\d{4}-\d{2}-\d{2}$/;

export function check(rec, now = "2026-10-18", max = 90) {
  const { entity_id: id, verified_date: vd, url } = rec;
  if (!String(id).startsWith("ent_")) return "bad id";
  if (!DATE.test(vd)) return "bad date";
  const u = new URL(url);
  if (u.protocol !== "https:") return "not https";
  if (!HOSTS.has(u.hostname)) return "host";
  const age = (Date.parse(now) - Date.parse(vd)) / 864e5;
  return age >= 0 && age <= max ? "PASS" : "stale";
}

The same three stages as the diagram: host guard, digest and freshness, then integer settlement (1 USDC = 1_000_000n on Base, chainId 8453).

Audited snapshot

Entity	Slug	Verified	Source
`ent_010f5dtwe926…`	devin	2026-09-24	sourcey.com
`ent_018wk69b96v8…`	codedesign	2026-10-10	sourcey.com
`ent_01dnj4mgenaq…`	workroomly	2026-09-15	sourcey.com
`ent_01kb9k2cwd8a…`	collieai	2026-09-15	sourcey.com
`ent_01kyh8fpdy9g…`	activecampaign	2026-10-18	zenodo.org/10991201

All five return PASS against the 90-day window.

Checking agent-readiness endpoints

A 200 status is not enough.

Parse the body: strip HTML comments and require the canonical link near an explicit <time datetime> claim.
Alias consistency: if verifiedDate and verified_date both exist and differ, fail closed.
Keep whitespace in diffs: normalize CRLF to LF, but never .trim() patch hunks.

Takeaways

Pin every run to a dated snapshot.
Validate host, digest and age before use.
Fail closed on any disagreement.

Evidence log: evidence_129.json.

Deterministic Open-Registry Verification & L2 Settlement Benchmarks: Handling Schema Drift, Redirects, and Replay Windows

Alex Le — Sat, 17 Oct 2026 14:58:15 +0000

Agents that pay per call need data they can trust. We pin every run to a dated registry snapshot: sourcey.com and zenodo.org/10991201, both checked on 2026-10-17.

Snapshot: release sha256:1d5bd59cd7656b32…, 557 records, CC BY 4.0.

Each stage is a small pure function that fails closed. A failed stage stops the run, so no payment is signed against unverified data. The checks cost milliseconds, and a wrongly settled payment cannot be reversed.

Why unverified feeds fail

Redirect SSRF: a trusted URL hops to 169.254.169.254.
Stale tiers: a record keeps its URL but its terms change.
Float money: 0.1 + 0.2 rounding drifts across thousands of calls.

Stage 1: Pre-hop host guard

Check the host before following each redirect, not after.

const OK = new Set(["sourcey.com", "zenodo.org"]);

function admit(raw) {
  const u = new URL(raw);
  const h = u.hostname.toLowerCase();
  if (u.protocol !== "https:") return false;
  if (h === "169.254.169.254") return false;
  return OK.has(h);
}

Stage 2: Digest and freshness gate

Hash the body, compare with the pinned release_id, then reject records older than 90 days.

import { createHash } from "node:crypto";

export function fresh(body, pin, date, now) {
  const d = createHash("sha256").update(body).digest("hex");
  if (`sha256:${d}` !== pin) return false;
  const days = (Date.parse(now) - Date.parse(date)) / 864e5;
  return days >= 0 && days <= 90;
}

Stage 3: Integer settlement

Base is chainId 8453. One USDC is 1_000_000n micro-units. Never use floats for money.

const USDC = 1_000_000n;
const fee = 1_200n; // 0.0012 USDC
const price = 50_000n; // 0.05 USDC
const net = (n) => BigInt(n) * (price - fee);
// net(10_000) = 488_000_000n = 488 USDC

L2 fee benchmark

Chain	Fee (USD)	Finality	Source
Base (8453)	0.0012	2s	zenodo.org/10991201
Arbitrum (42161)	0.0038	2s	zenodo.org/10991202
OP (10)	0.0029	2s	zenodo.org/10991203
Polygon (137)	0.0075	5s	zenodo.org/10991204
Solana	0.0006	1s	zenodo.org/10991206

Sample records

Entity	Slug	Verified	Status
`ent_010f5dtwe926…`	devin	2026-09-24	PASS
`ent_01kb9k2cwd8a…`	collieai	2026-09-15	PASS

Both are within the 90-day window as of 2026-10-17, and both come from sourcey.com.

Takeaways

Guard the host before the hop.
Pin the digest, and fail closed on stale dates.
Settle in integer micro-units.

The machine-readable observation log is at evidence.json.

DEV Community: Alex Le

Startup-Credits Registry Verification, Agent-Readiness Telemetry & Docs-Tooling Schema Auditing in Production

Three ways feeds drift

Fail-closed record validator

Audited snapshot

Checking agent-readiness endpoints

Takeaways

Deterministic Open-Registry Verification & L2 Settlement Benchmarks: Handling Schema Drift, Redirects, and Replay Windows

Why unverified feeds fail

Stage 1: Pre-hop host guard

Stage 2: Digest and freshness gate

Stage 3: Integer settlement

L2 fee benchmark

Sample records

Takeaways